Forwarded headers behind a tunnel are only safe when the first hop you operate overwrites client-supplied X-Forwarded-For, Proto, and Host, and the application trusts a hop list that matches those addresses. Prefer a tight trustProxy (or equivalent) that names the tunnel or edge CIDR, drop or replace inbound forwarded fields from untrusted clients, and pin the expected Host so a spoofed authority cannot change routing, cookies, or generated absolute paths. Treat Proto as an operator-set scheme bit, not as a client-editable flag.
Ops prove-out after tightening trust: send a request with forged X-Forwarded-For, Proto, and Host from outside the trusted hop list and confirm the app still logs the real connecting address and the pinned Host, then repeat from the trusted tunnel and confirm the client address and scheme are the ones the edge injected. Watch access logs, rate-limit identity, and redirect targets for one change window — a mismatch usually means the app still appends client-supplied hops or trusts a hop count that the tunnel does not consume. Keep the hop list versioned with the tunnel or edge change so a new egress address cannot silently widen trust.
Edge Ops
Forwarded headers behind a tunnel are only safe when the first hop you operate overwrites client-supplied X-Forwarded-For, Proto, and Host, and the application trusts a hop list that matches those addresses. Prefer a tight trustProxy (or equivalent) that names the tunnel or edge CIDR, drop or replace inbound forwarded fields from untrusted clients, and pin the expected Host so a spoofed authority cannot change routing, cookies, or generated absolute paths. Treat Proto as an operator-set scheme bit, not as a client-editable flag.
Ops prove-out after tightening trust: send a request with forged X-Forwarded-For, Proto, and Host from outside the trusted hop list and confirm the app still logs the real connecting address and the pinned Host, then repeat from the trusted tunnel and confirm the client address and scheme are the ones the edge injected. Watch access logs, rate-limit identity, and redirect targets for one change window — a mismatch usually means the app still appends client-supplied hops or trusts a hop count that the tunnel does not consume. Keep the hop list versioned with the tunnel or edge change so a new egress address cannot silently widen trust.